and-intake

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs preserving "errors, logs... environment details" and to keep "literal identifiers verbatim," which would require copying any embedded secrets or API keys from user-provided artifacts into the output, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s Intake workflow explicitly reads externally provided GitHub PR content (“when the user explicitly presents a PR, read external-pr-signals.md,” which instructs to search GitHub issues/PR references and capture PR URL/description/diff-check evidence), making outsider-authored free text indirectly ingested at runtime.